Main Categories

The present document specifies technical requirements and corresponding assessment criteria for software products 
with digital elements that detect or search for malicious software or code on a device, or remove or quarantine such 
software or code to prevent or mitigate system infection related to cybersecurity. The products with digital elements in 
scope, thereafter "the product": 
• are specified within the "technical description" of the "category of product" number "4" by the Commission 
Implementing Regulation (EU) 2025/2392 [i.2] as: - 
"Software products with digital elements, typically referred to as antivirus or antimalware, that detect or 
search for malicious software or code on devices, or remove or quarantine such software or code, in 
order to maintain the integrity, confidentiality, or availability of such devices. 
In the context of this category of products, malicious software means software containing malicious 
features or capabilities that can cause harm directly or indirectly to the user and/or the computer system, 
such as viruses, worms, ransomware, spyware and trojans. 
This category includes but is not limited to software that detects or searches for malicious software in 
real-time or manually, rootkit detection and rescue disks with the core functionality of searching, 
removing or quarantining malicious software." 
• are only covered within the product context described in clause 4. 
The present document covers those products to demonstrate compliance with essential cybersecurity requirements in the 
Regulation (EU) 2024/2847 [i.1], Annex I, Part I under the conditions identified in Annex A. 
The present document specifies technical characteristics and methods of assessment for Antivirus/Antimalware 
products. 

The present document specifies vulnerability handling activities, technical requirements and corresponding assessment 
criteria for smart home general purpose virtual assistants related to cybersecurity. The products with digital elements in 
scope, thereafter "smart home general purpose virtual assistants": 
• are specified within the "technical description" of the "category of product" number "16." by the Commission 
Implementing Regulation (EU) 2025/2392 [i.2] as: 
"Products with digital elements that communicate on the public Internet, whether directly or via other 
equipment, that process demands, tasks or questions based on natural language prompts, such as through audio 
or written input, and that, based on those demands, tasks or questions, provide access to other services or 
control the functions of connected devices in residential settings. 
This category includes but is not limited to smart speakers with an integrated virtual assistant, and standalone 
virtual assistants that meet this description"; and 
• are only covered within the product context described in clause 4. 
The present document covers those products to demonstrate compliance with essential cybersecurity requirements in the 
Regulation (EU) 2024/2847 [i.1], Annex I, Part I under the conditions identified in Annex A

The present document specifies vulnerability handling activities, technical requirements and corresponding assessment 
criteria for smart home products with security functionalities related to cybersecurity. The products with digital 
elements in scope, thereafter "smart home products with security functionalities": 
• are specified within the "technical description" of the "category of product" number "17." by the Commission 
Implementing Regulation (EU) 2025/2392 [i.2] as: 
"Products with digital elements that protect the physical security of consumers in a residential setting and 
which can be controlled or managed remotely from other systems, as well as hardware and software that 
centrally control such products. 
This category includes but is not limited to smart door locking devices, baby monitoring systems, alarm 
systems and home security cameras"; and 
• are only covered within the product context described in clause 4. 
The present document covers those products to demonstrate compliance with essential cybersecurity requirements in the 
Regulation (EU) 2024/2847 [i.1], Annex I, Part I under the conditions identified in clause A.

The present document specifies vulnerability handling activities, technical requirements and corresponding assessment 
criteria for internet connected toys related to cybersecurity. The products with digital elements in scope, thereafter 
"internet connected toys": 
• are specified within the "technical description" of the "category of product" number "18." by the Commission 
Implementing Regulation (EU) 2025/2392 [i.2] as: 
"Internet connected toys that have social interactive features are products with digital elements that are 
covered by Directive 2009/48/EC, that communicate on the public Internet, whether directly or via any other 
equipment, and that have embedded technologies that enable inbound and outbound communication, such as 
keyboard, microphone, speaker or camera." or "Internet connected toys that have location tracking features are 
products with digital elements that are covered by Directive 2009/48/EC, that communicate on the public 
Internet, whether directly or via any other equipment, and that have technologies that enable tracking or 
inferring of the geographical location of the toy or its user. Where the toy merely detects the proximity of the 
user or of other toys by using sensing technologies, the toy is not to be considered to have location tracking 
features." and 
• are only covered within the product context described in clause 4. 
The present document covers those products to demonstrate compliance with essential cybersecurity requirements in the 
Regulation (EU) 2024/2847 [i.1] under the conditions identified in annex A.

The present document specifies technical requirements and corresponding assessment criteria for personal wearable 
products that have a health monitoring purpose or that are intended for the use by and for children, related to 
cybersecurity. The products with digital elements in scope, thereafter "personal wearable": 
• are specified within the "technical description" of the "category of product" number "19" by the Commission 
Implementing Regulation (EU) 2025/2392 of 28 November 2025 [i.2] as: 
"Personal wearable products to be worn or placed on a human body that have a health monitoring (such as 
tracking) purpose and to which Regulation (EU) 2017/745(2)or (EU) 2017/746 of the European Parliament 
and of the Council do not apply, or personal wearable products that are intended for the use by and for 
children". 
• are only covered within the product context described in clause 4. 
The present document covers those products to demonstrate compliance with essential cybersecurity requirements in the 
Regulation (EU) 2024/2847 [i.1] Annex I Part I under the conditions identified in Annex A.